AWS Batch EKS access entries: what to check before enabling

What does this change?

On October 5, 2026, AWS announced that AWS Batch can authenticate to Amazon EKS compute environments through access entries. An access entry is an API-managed record of cluster access and can complement the older aws-auth ConfigMap method.

Set eksConfiguration.accessEntry.desiredState in a CreateComputeEnvironment or UpdateComputeEnvironment request. When the conditions are met, AWS Batch creates one Batch-managed access entry per cluster for its service-linked role and associates AWSBatchClusterPolicy.

The feature is available in every AWS Region where AWS Batch is available. It does not create or manage an EKS cluster, and it does not configure namespace permissions or node-role access for you.

Check the EKS authenticationMode first

With CONFIG_MAP authentication, the cluster does not support access entries. AWS Batch can record the desiredState you specify, but it will not create or delete an access entry; Batch continues to authenticate through aws-auth.

With API authentication, access entries are the cluster's authentication path. ENABLED lets AWS Batch manage the entry, and INHERIT_FROM_CLUSTER also creates and manages it on an API-only cluster. DISABLED is rejected because an API-only cluster has no aws-auth ConfigMap to fall back to.

With API_AND_CONFIG_MAP, AWS Batch compares the recorded values for every Batch compute environment in the same AWS account and Region that targets the cluster. It creates the entry only when all are ENABLED and deletes it only when all are DISABLED.

If the values differ, or an environment has no recorded desiredState, Batch keeps the current access mode instead of switching the cluster based on one ENABLED or DISABLED value. INHERIT_FROM_CLUSTER does not by itself add or remove an entry in this mode.

An access entry does not finish every permission step

The IAM identity calling CreateComputeEnvironment or UpdateComputeEnvironment needs the relevant EKS permissions: eks:DescribeCluster, eks:DescribeAccessEntry, eks:CreateAccessEntry, eks:AssociateAccessPolicy, and eks:DeleteAccessEntry.

AWSBatchClusterPolicy is a cluster-level policy. After enabling a Batch-managed access entry, you must also associate the namespace-scoped AWSBatchNamespacePolicy with the service-linked role so Batch can create and manage pods in the specified namespace. Without that association, jobs can remain in RUNNABLE.

The nodes join the cluster using the instance role in computeResources.instanceRole. That role needs separate cluster access. In API mode, create an access entry for the node role; in API_AND_CONFIG_MAP mode, an existing valid aws-auth mapping can also authenticate that role.

DescribeComputeEnvironments returns accessEntry.status=ACTIVE when the Batch-managed entry exists. AWS notes that the policy association might still be in progress, so ACTIVE alone does not prove that job permissions are ready.

Inventory the cluster, then verify each step

List every AWS Batch EKS compute environment in the same account and Region that targets the cluster, and record its authenticationMode, desiredState, and namespace. Do not check only the environment you plan to change.

Confirm that the cluster's authentication mode supports the intended transition and that the IAM identity making the change has the AWS Batch permissions and EKS actions listed above. For API_AND_CONFIG_MAP, plan to set a consistent state across all target environments.

For each existing compute environment you intend to enable, update the access-entry state with this command. Replace the placeholder with your compute environment name and make the change consistently across the cluster: aws batch update-compute-environment --compute-environment <compute-environment-name> --eks-configuration 'accessEntry={desiredState=ENABLED}'

Then use DescribeComputeEnvironments to inspect desiredState and status. Separately verify AWSBatchNamespacePolicy and the node instance role's access. You can validate job behavior in a nonproduction or controlled queue; this article does not report testing in a reader's environment.

AWS says the Batch service itself has no additional charge. The EKS cluster and resources such as EC2 instances can still incur costs. EKS cluster pricing varies with the Kubernetes version support tier, so check current pricing for the target Region.

Disable or delete environments in the right order

To return an API_AND_CONFIG_MAP cluster to aws-auth, set DISABLED on every AWS Batch compute environment that targets the cluster, then confirm the access entry has been removed before relying on the ConfigMap path. An API-only cluster rejects DISABLED, so do not treat it as a valid rollback step.

Deleting an AWS Batch compute environment does not automatically remove the Batch-managed access entry, even when it is the last environment. If you need to remove the entry, set DISABLED on every targeting environment before deleting them, and confirm that the cluster's other access and node-role settings remain valid.